2

Lets say we delete various files , from hard disk A, with shift - delete , windows 8 . Then we copy new files to the same hard disk A. Then those new files we just copied there to hard disk A, we copy to a USB stick , or to a DVD. Those new copied files are now laying to a total different hard disk drive B . Is there anyway , those new copied files that came from the hard disk A , but now laying in the different hard disk B , to include any traces of the previous deleted files from hard disk A , so that recovery software be able to recover , if we run the recovery software from the hard disk B ? I only used normal windows explorer copy and paste, for copying the files.

4

It depends on how you copy them.

  • If you do a bitwise copy, aka exactly replicating every single bit from one disk to the other, you are copying over "slack space" which is where the recovery tool will work.

  • If you do a file copy, then the empty space of the disk is ignored, and only the segments of data attached to a file header will copy over. The recovery tool cannot see the slack space attached to the other disk.

  • Thank you Ohnana for your detailed reply. I used the normal windows explorer copy paste method. So I assume it's the 2nd option of your reply , right ? That the recovery tool cannot see the slack space attached to the other disk , so no traces of the previous deleted files are copied ? – Vonzar Jan 15 '16 at 23:48
  • Correct. You're all clear. – Ohnana Jan 15 '16 at 23:57
  • Thank you again!I was skeptical about it for the reason that file shredding need to use methods like guttman x35,or x7 overwritten methods of empty space to secure safe deletion of data.So I assumed that when I write new files on the hard disk drive after I deleted previous files,there is probably a chance for the new files that are being copied to overwrite the empty space just once(x1).So maybe some traces of the previous deleted files are left on that new over written files,since it's only x1 times overwrite method with a simple copy paste of windows explorer.That's probably wrong? – Vonzar Jan 16 '16 at 0:14
  • Ohnana Is it possible to share your knowledge with the question above this comment ? Thank you in advance. – Vonzar Jan 17 '16 at 8:33
  • I don't quite understand what you're saying. If you copy files with explorer, you do not write any trace of deleted files. Writing over slack space once is enough to deter most commercially available recovery tools. To deter professional tools and high-resource ways of recovering files, overwriting 7-35 times is needed. – Ohnana Jan 17 '16 at 14:40
1

TL;DR; It depends how you moved it.

If you have never moved the files to Hard Drive B, it won't carry over the traces.

The way the files are stored on a hard drive would leave traces of the file on Hard Drive A (gets overwritten over a period of time). The difference is that when you copy files from one hard drive to another, it only copies the files you selected and skips the rest of the platter (skips the traces of deleted files).

Now, there's an exception to this. If you Clone the hard drive (I.E. Sector-to-Sector copy), that can carry over those traces because cloning the drive itself brings over all data on the platters (deleted or not).

Hardware cloning is usually a sector-to-sector copy, moving over everything to be the exact same (including partition sizes).

Software cloning is more flexible, because it can do both an exact copy of the platter (bringing over traces of the deleted file) or copy only the existing files (skips deleted files). Don't misunderstand when I say deleted files, I do not mean files left in the Recycle Bin.

I could be missing some information here, but I hope this answers your question.

  • Thank you dakre18 for your kind reply. I only used normal windows explorer copy and paste. So I assume everything is safe and no traces of the previous deleted files are carried over , right ? – Vonzar Jan 15 '16 at 23:51
  • That's correct. Windows will not move permanently deleted data, but if it is sitting in your recycle bin, it still can. Once it's been deleted from there, think of it like a fingerprint on some glass, because once you remove your finger from the glass the fingerprint is still there (traces of files on the HDD platter). Once another fingerprint (I.E. files or data) overlaps it, then it becomes harder to see the first fingerprint. At some point it gets wiped clean or overlapped until it's completely gone. Analogies can sometimes make it easier to understand, even if it isn't the best. – dakre18 Jan 16 '16 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.